AWS SAA-C03 Course Notes

SAA-C03 security scenarios usually start with identity boundaries. IAM roles are preferred when AWS services, applications, or users need permissions without long-term access keys. AWS STS issues temporary credentials when a role is assumed, and cross-account roles are the clean pattern for granting access into another AWS account. IAM Identity Center and federation fit workforce sign-in scenarios where users authenticate through an external identity provider and receive role-based AWS access.

• Creating IAM users with long-term keys when the scenario asks for temporary delegated access through IAM roles and STS.

• Use IAM roles and STS for temporary access, especially across accounts.

Resilient designs on SAA-C03 often use events and queues to absorb failure. SNS is selected for fanout notifications to multiple subscribers, while SQS is selected when producers and consumers need decoupling, buffering, and retry isolation. Lambda fits event processing when work can run as stateless functions triggered by queues, notifications, streams, or service events.

• Choosing SQS FIFO for every queue even when the requirement values maximum throughput over strict ordering.

• SNS fans out notifications; SQS buffers and decouples; Lambda processes events.

Performance questions often begin with storage latency, throughput, and access pattern. Use EBS gp3 when general-purpose block storage needs predictable baseline performance with separately configurable IOPS and throughput. Use io1 or io2 when a database or critical workload needs sustained high IOPS and low latency. EFS fits shared Linux file access across instances, FSx fits managed high-performance file systems such as Windows file shares, and Instance Store fits temporary local scratch data rather than durable storage.

• Using read replicas to solve write bottlenecks when they mainly scale read traffic.

• Match the bottleneck: storage IOPS, read scaling, cache latency, edge delivery, streaming ingestion, or batch processing.

Cost optimization on SAA-C03 is usually a design choice, not a billing report. S3 Glacier storage classes reduce long-term storage cost when retrieval can be slower, with Glacier Deep Archive fitting rarely accessed compliance or archive data. S3 Intelligent-Tiering fits data with unknown or changing access patterns, and lifecycle policies move or expire objects based on age, prefix, tags, or version state.

• Choosing Glacier Deep Archive for data that needs immediate retrieval.

• Lifecycle policies transition or expire data; Intelligent-Tiering handles changing access patterns.